noname Electron desktop build local file server lacks authentication, allowing file tampering

Malicious websites can overwrite this game app's files and hack your PC.

Summary

The local file server in the noname Electron desktop build has no authentication, so malicious websites can read, overwrite, or delete installation files. Versions v1.11.2 through v1.11.6.1 are affected.

Affected when

noname Electron desktop build v1.11.2 or later through v1.11.6.1
app running (localhost port 8089)

What to do

No source names a fixed version. Check that you run a version newer than v1.11.6.1, and read the vendor's advisory.

Products and platforms

Windows
macOS
Linux
libnoname noname

CVE IDs

CVE-2026-123208 (opens in a new tab)

Sources

Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab)

Times

First published 2026-11-05 18:16 UTC

First seen 2026-11-09 17:00 UTC